I'm developping a web application which will be communicating with a server over WebAPI. The server side will be on Azure and the client side will be on custom hosting with a JavaScript application (for example with ReactJS).
I want to authentificate the user like this:
- User enter login and pass in client app.
- Pass and login are sent to server over HTTPS with AJAX.
- If authentication succeed, server return a token to the client.
- Token is stored in local storage.
- All future requests to the server will contains the previously stored token as a parameter.
Is that authentication model secure enough? We always use .NET MVC for now, and store user information in server session, but this is new situation, where client didn't run on server directly, but only communicate with it over HTTPS.